@seamless-auth/core 0.7.0 → 0.10.0

package/README.md

@@ -88,13 +88,29 @@ Key exports include:
 - `refreshAccessToken(...)` – rotates expired access sessions
 - `verifyCookieJwt(...)` – verifies signed cookie payloads
 - `createServiceToken(...)` – creates short-lived M2M assertions
+- `getSeamlessUser(...)` – resolves the hydrated user, typed as `SeamlessUser | null`
 - `hasScopedRole(...)` – checks scoped role grants such as `admin:read`
+- `assertSecretStrength(...)` / `assertSecrets(...)` – enforce the minimum secret length
+- `redactSensitiveText(...)` – masks tokens, bearer values, and secrets before logging
 - `listOAuthProvidersHandler(...)` – retrieves public OAuth provider metadata
 - `startOAuthLoginHandler(...)` – starts an OAuth authorization-code login
 - `finishOAuthLoginHandler(...)` – finishes OAuth login and returns cookie instructions
 
 These functions return **descriptive results**, not HTTP responses.
 
+### Secret strength
+
+`cookieSecret` and `serviceSecret` must be at least 32 characters (`MIN_SECRET_LENGTH`). A shorter
+secret can be brute forced offline, which would let an attacker forge cookie sessions and service
+tokens.
+
+The check runs wherever a secret enters the core as configuration: `ensureCookies`,
+`refreshAccessToken`, `getSeamlessUser`, and `createServiceToken` all throw on a missing or weak
+secret. `verifyCookieJwt` and `verifyRefreshCookie` are low-level primitives and keep their
+"return `null` on failure" contract unchanged.
+
+Generate secrets with a CSPRNG, for example `openssl rand -base64 48`.
+
 ---
 
 ## Example (Adapter Pseudocode)

package/dist/authFetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authFetch.d.ts","sourceRoot":"","sources":["../src/authFetch.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,QAAQ,CAAC,CAuBnB"}
+{"version":3,"file":"authFetch.d.ts","sourceRoot":"","sources":["../src/authFetch.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,QAAQ,CAAC,CAoBnB"}

package/dist/authFetch.js

@@ -3,10 +3,8 @@ export async function authFetch(url, options) {
         "Content-Type": "application/json",
         ...options.headers,
         ...(options.authorization ? { Authorization: options.authorization } : {}),
-        ...((options.serviceAuthorization ?? options.authorization)
-            ? {
-                "x-seamless-service-token": options.serviceAuthorization ?? options.authorization,
-            }
+        ...(options.serviceAuthorization
+            ? { "x-seamless-service-token": options.serviceAuthorization }
             : {}),
         ...(options.forwardedClientIp
             ? { "x-seamless-client-ip": options.forwardedClientIp }
@@ -22,7 +20,7 @@ export async function authFetch(url, options) {
 // Upstream responses aren't always JSON: a rate-limited request comes back as plain
 // text ("Too many requests…") and a 204 has no body. Native Response.json() throws on
 // both, which would crash callers that parse the body before checking the status. Make
-// json() tolerant so callers always get a value — parsed JSON, { message: text } for a
+// json() tolerant so callers always get a value: parsed JSON, { message: text } for a
 // non-JSON body, or undefined for an empty one.
 function makeJsonTolerant(response) {
     if (typeof response.text !== "function") {

package/dist/authFetch.js.map

@@ -1 +1 @@
-{"version":3,"file":"authFetch.js","sourceRoot":"","sources":["../src/authFetch.ts"],"names":[],"mappings":"AAaA,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,OAAyB;IAEzB,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,GAAG,OAAO,CAAC,OAAO;QAClB,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,CAAC,OAAO,CAAC,oBAAoB,IAAI,OAAO,CAAC,aAAa,CAAC;YACzD,CAAC,CAAC;gBACE,0BAA0B,EACxB,OAAO,CAAC,oBAAoB,IAAI,OAAO,CAAC,aAAc;aACzD;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,iBAAiB;YAC3B,CAAC,CAAC,EAAE,sBAAsB,EAAE,OAAO,CAAC,iBAAiB,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;QACP,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;KAC9D,CAAC,CAAC;IAEH,OAAO,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,oFAAoF;AACpF,sFAAsF;AACtF,uFAAuF;AACvF,uFAAuF;AACvF,gDAAgD;AAChD,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,QAAQ,CAAC,IAAI,GAAG,KAAK,IAAI,EAAE;QACzB,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"authFetch.js","sourceRoot":"","sources":["../src/authFetch.ts"],"names":[],"mappings":"AAaA,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,OAAyB;IAEzB,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,GAAG,OAAO,CAAC,OAAO;QAClB,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,OAAO,CAAC,oBAAoB;YAC9B,CAAC,CAAC,EAAE,0BAA0B,EAAE,OAAO,CAAC,oBAAoB,EAAE;YAC9D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,iBAAiB;YAC3B,CAAC,CAAC,EAAE,sBAAsB,EAAE,OAAO,CAAC,iBAAiB,EAAE;YACvD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;QACP,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;KAC9D,CAAC,CAAC;IAEH,OAAO,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,oFAAoF;AACpF,sFAAsF;AACtF,uFAAuF;AACvF,sFAAsF;AACtF,gDAAgD;AAChD,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9C,QAAQ,CAAC,IAAI,GAAG,KAAK,IAAI,EAAE;QACzB,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/authMessaging.d.ts

@@ -44,12 +44,6 @@ export interface SendMagicLinkEmailInput {
     from?: string;
     subject?: string;
 }
-export interface SendBootstrapInviteEmailInput {
-    to: string;
-    inviteUrl: string;
-    from?: string;
-    subject?: string;
-}
 export interface AuthMessageOverrideContext {
     appName?: string;
 }
@@ -57,13 +51,11 @@ export interface AuthMessageOverrides {
     otpEmail?: (input: SendOtpEmailInput, defaults: EmailMessage, context: AuthMessageOverrideContext) => EmailMessage;
     otpSms?: (input: SendOtpSmsInput, defaults: SmsMessage, context: AuthMessageOverrideContext) => SmsMessage;
     magicLinkEmail?: (input: SendMagicLinkEmailInput, defaults: EmailMessage, context: AuthMessageOverrideContext) => EmailMessage;
-    bootstrapInviteEmail?: (input: SendBootstrapInviteEmailInput, defaults: EmailMessage, context: AuthMessageOverrideContext) => EmailMessage;
 }
 export interface AuthMessagingHandlers {
     sendOtpEmail(input: SendOtpEmailInput): Promise<DeliveryResult>;
     sendOtpSms(input: SendOtpSmsInput): Promise<DeliveryResult>;
     sendMagicLinkEmail(input: SendMagicLinkEmailInput): Promise<DeliveryResult>;
-    sendBootstrapInviteEmail(input: SendBootstrapInviteEmailInput): Promise<DeliveryResult>;
 }
 export interface SeamlessAuthMessagingOptions {
     email?: EmailTransport;
@@ -89,10 +81,5 @@ export type AuthDeliveryInstruction = {
     to: string;
     token?: string;
     magicLinkUrl: string;
-} | {
-    kind: "bootstrap_invite_email";
-    to: string;
-    token?: string;
-    inviteUrl: string;
 };
 //# sourceMappingURL=authMessaging.d.ts.map

package/dist/authMessaging.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authMessaging.d.ts","sourceRoot":"","sources":["../src/authMessaging.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,KAAK,CAAC;AAE/C,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,6BAA6B;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,iBAAiB,EACxB,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,0BAA0B,KAChC,YAAY,CAAC;IAClB,MAAM,CAAC,EAAE,CACP,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,UAAU,EACpB,OAAO,EAAE,0BAA0B,KAChC,UAAU,CAAC;IAChB,cAAc,CAAC,EAAE,CACf,KAAK,EAAE,uBAAuB,EAC9B,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,0BAA0B,KAChC,YAAY,CAAC;IAClB,oBAAoB,CAAC,EAAE,CACrB,KAAK,EAAE,6BAA6B,EACpC,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,0BAA0B,KAChC,YAAY,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAChE,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5D,kBAAkB,CAChB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3B,wBAAwB,CACtB,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,cAAc,CAAC,CAAC;CAC5B;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC1C,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,MAAM,uBAAuB,GAC/B;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf,GACD;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;CACxB,GACD;IACE,IAAI,EAAE,kBAAkB,CAAC;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;CACtB,GACD;IACE,IAAI,EAAE,wBAAwB,CAAC;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC"}
+{"version":3,"file":"authMessaging.d.ts","sourceRoot":"","sources":["../src/authMessaging.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,KAAK,CAAC;AAE/C,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,iBAAiB,EACxB,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,0BAA0B,KAChC,YAAY,CAAC;IAClB,MAAM,CAAC,EAAE,CACP,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,UAAU,EACpB,OAAO,EAAE,0BAA0B,KAChC,UAAU,CAAC;IAChB,cAAc,CAAC,EAAE,CACf,KAAK,EAAE,uBAAuB,EAC9B,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,0BAA0B,KAChC,YAAY,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAChE,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5D,kBAAkB,CAChB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,cAAc,CAAC,CAAC;CAC5B;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC1C,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,MAAM,uBAAuB,GAC/B;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf,GACD;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;CACxB,GACD;IACE,IAAI,EAAE,kBAAkB,CAAC;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC"}

package/dist/createServiceToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createServiceToken.d.ts","sourceRoot":"","sources":["../src/createServiceToken.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAiBpE"}
+{"version":3,"file":"createServiceToken.d.ts","sourceRoot":"","sources":["../src/createServiceToken.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAmBpE"}

package/dist/createServiceToken.js

@@ -1,5 +1,7 @@
 import jwt from "jsonwebtoken";
+import { assertSecretStrength } from "./validateSecrets.js";
 export function createServiceToken(opts) {
+    assertSecretStrength("serviceSecret", opts.serviceSecret);
     return jwt.sign({
         iss: opts.issuer,
         aud: opts.audience,

package/dist/createServiceToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"createServiceToken.js","sourceRoot":"","sources":["../src/createServiceToken.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAC;AAY/B,MAAM,UAAU,kBAAkB,CAAC,IAAyB;IAC1D,OAAO,GAAG,CAAC,IAAI,CACb;QACE,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,GAAG,EAAE,IAAI,CAAC,OAAO;QACjB,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAChE,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;KACnC,EACD,IAAI,CAAC,aAAa,EAClB;QACE,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,OAAO;QAClB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"createServiceToken.js","sourceRoot":"","sources":["../src/createServiceToken.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAC;AAE/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAY5D,MAAM,UAAU,kBAAkB,CAAC,IAAyB;IAC1D,oBAAoB,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAE1D,OAAO,GAAG,CAAC,IAAI,CACb;QACE,GAAG,EAAE,IAAI,CAAC,MAAM;QAChB,GAAG,EAAE,IAAI,CAAC,QAAQ;QAClB,GAAG,EAAE,IAAI,CAAC,OAAO;QACjB,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAChE,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;KACnC,EACD,IAAI,CAAC,aAAa,EAClB;QACE,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,OAAO;QAClB,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CACF,CAAC;AACJ,CAAC"}

package/dist/ensureCookies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ensureCookies.d.ts","sourceRoot":"","sources":["../src/ensureCookies.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,aAAa,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IACF,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AA0LD,wBAAsB,aAAa,CACjC,KAAK,EAAE,kBAAkB,EACzB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,mBAAmB,CAAC,CAyF9B"}
+{"version":3,"file":"ensureCookies.d.ts","sourceRoot":"","sources":["../src/ensureCookies.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,aAAa,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE;QACL,GAAG,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IACF,UAAU,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAiND,wBAAsB,aAAa,CACjC,KAAK,EAAE,kBAAkB,EACzB,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,mBAAmB,CAAC,CA+F9B"}

package/dist/ensureCookies.js

@@ -1,6 +1,6 @@
 import { verifyCookieJwt } from "./verifyCookieJwt.js";
 import { refreshAccessToken } from "./refreshAccessToken.js";
-import { redactSensitiveText } from "./redaction.js";
+import { assertSecrets } from "./validateSecrets.js";
 const COOKIE_REQUIREMENTS = {
     "/webAuthn/login/finish": { name: "preAuthCookieName", required: true },
     "/webAuthn/login/start": { name: "preAuthCookieName", required: true },
@@ -44,17 +44,30 @@ const COOKIE_REQUIREMENTS = {
         name: "preAuthCookieName",
         required: true,
     },
-    "/magic-link": {
+    // The token in "/magic-link/verify/:token" is itself the credential, so a
+    // link opened on a different device (no pre-auth or refresh cookie) must not
+    // be gated. This entry must precede "/magic-link" so the prefix-match find()
+    // below selects it first.
+    "/magic-link/verify": {
         name: "preAuthCookieName",
-        required: true,
+        required: false,
     },
+    // Must precede "/magic-link" for the same prefix-match reason; otherwise this
+    // entry is shadowed and would silently stop applying if its config diverged.
     "/magic-link/check": {
         name: "preAuthCookieName",
         required: true,
     },
+    "/magic-link": {
+        name: "preAuthCookieName",
+        required: true,
+    },
     "/logout/all": { name: "accessCookieName", required: true },
     "/logout": { name: "accessCookieName", required: true },
     "/users/me": { name: "accessCookieName", required: true },
+    "/users/update": { name: "accessCookieName", required: true },
+    "/users/credentials": { name: "accessCookieName", required: true },
+    "/sessions": { name: "accessCookieName", required: true },
     "/organizations": { name: "accessCookieName", required: true },
     "/step-up/status": { name: "accessCookieName", required: true },
     "/step-up/webauthn/start": { name: "accessCookieName", required: true },
@@ -83,6 +96,10 @@ const COOKIE_REQUIREMENTS = {
         name: "accessCookieName",
         required: true,
     },
+    "/admin/credential-count": {
+        name: "accessCookieName",
+        required: true,
+    },
     "/admin/sessions": {
         name: "accessCookieName",
         required: true,
@@ -99,6 +116,11 @@ const COOKIE_REQUIREMENTS = {
         name: "accessCookieName",
         required: true,
     },
+    // Prefix match covers both the collection and the id-scoped provider routes.
+    "/system-config/oauth-providers": {
+        name: "accessCookieName",
+        required: true,
+    },
     "/system-config/roles": {
         name: "accessCookieName",
         required: true,
@@ -169,6 +191,7 @@ async function refreshRequiredCookie(cookieName, refreshCookie, opts) {
     };
 }
 export async function ensureCookies(input, opts) {
+    assertSecrets(opts);
     // Match case-insensitively: Express route matching is case-insensitive by
     // default, so a client may send a path whose casing differs from the mounted
     // route (e.g. "/webauthn/..." vs "/webAuthn/..."). A case-sensitive miss here
@@ -177,10 +200,15 @@ export async function ensureCookies(input, opts) {
     const requestPath = input.path.toLowerCase();
     const match = Object.entries(COOKIE_REQUIREMENTS).find(([path]) => requestPath.startsWith(path.toLowerCase()));
     if (!match) {
-        console.debug("[SEAMLESS-AUTH-CORE] - (ensureCookies) - No cookie requirements for this path. Path: ", redactSensitiveText(input.path));
         return { type: "ok" };
     }
     const [, { name, required }] = match;
+    // A not-required entry marks a route that is explicitly ungated: it must pass
+    // through regardless of which cookies are (or are not) present, so a stale or
+    // absent cookie never blocks it.
+    if (!required) {
+        return { type: "ok" };
+    }
     const cookieName = opts[name];
     if (!cookieName) {
         return {

package/dist/ensureCookies.js.map

@@ -1 +1 @@
-{"version":3,"file":"ensureCookies.js","sourceRoot":"","sources":["../src/ensureCookies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAsDrD,MAAM,mBAAmB,GAGrB;IACF,wBAAwB,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE;IACvE,uBAAuB,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE;IACtE,0BAA0B,EAAE;QAC1B,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,IAAI;KACf;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,IAAI;KACf;IACD,uBAAuB,EAAE;QACvB,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,IAAI;KACf;IACD,uBAAuB,EAAE;QACvB,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,IAAI;KACf;IACD,yBAAyB,EAAE;QACzB,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,IAAI;KACf;IACD,yBAAyB,EAAE;QACzB,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,IAAI;KACf;IACD,6BAA6B,EAAE;QAC7B,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,IAAI;KACf;IACD,6BAA6B,EAAE;QAC7B,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,IAAI;KACf;IACD,+BAA+B,EAAE;QAC/B,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,IAAI;KACf;IACD,+BAA+B,EAAE;QAC/B,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,IAAI;KACf;IACD,aAAa,EAAE;QACb,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,IAAI;KACf;IACD,mBAAmB,EAAE;QACnB,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,IAAI;KACf;IACD,aAAa,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC3D,SAAS,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IACvD,WAAW,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IACzD,gBAAgB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC9D,iBAAiB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC/D,yBAAyB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IACvE,0BAA0B,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IACxE,cAAc,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC5D,oBAAoB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAClE,qBAAqB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IACnE,eAAe,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC7D,kBAAkB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAChE,6BAA6B,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC3E,+BAA+B,EAAE;QAC/B,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,IAAI;KACf;IACD,kCAAkC,EAAE;QAClC,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,IAAI;KACf;IAED,+BAA+B,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC7E,mCAAmC,EAAE;QACnC,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,IAAI;KACf;IAED,8BAA8B,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAE5E,aAAa,EAAE;QACb,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,IAAI;KACf;IACD,iBAAiB,EAAE;QACjB,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,IAAI;KACf;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,IAAI;KACf;IACD,sBAAsB,EAAE;QACtB,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,IAAI;KACf;IAED,sBAAsB,EAAE;QACtB,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,IAAI;KACf;IAED,sBAAsB,EAAE;QACtB,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,IAAI;KACf;CACF,CAAC;AAEF,KAAK,UAAU,qBAAqB,CAClC,UAAkB,EAClB,aAAiC,EACjC,IAA0B;IAE1B,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE;QACxD,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,gBAAgB;YACvB,YAAY,EAAE;gBACZ,UAAU;gBACV,IAAI,CAAC,sBAAsB;gBAC3B,IAAI,CAAC,iBAAiB;aACvB;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,IAAI;QACV,IAAI,EAAE;YACJ,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC;YACvC,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,KAAK,EAAE,SAAS,CAAC,KAAK;SACvB;QACD,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE;oBACL,GAAG,EAAE,SAAS,CAAC,GAAG;oBAClB,GAAG,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS;wBACnC,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC;oBACvC,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,cAAc,EAAE,SAAS,CAAC,cAAc,IAAI,IAAI;iBACjD;gBACD,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;YACD;gBACE,IAAI,EAAE,IAAI,CAAC,iBAAiB;gBAC5B,KAAK,EAAE;oBACL,GAAG,EAAE,SAAS,CAAC,GAAG;oBAClB,YAAY,EAAE,SAAS,CAAC,YAAY;iBACrC;gBACD,GAAG,EAAE,SAAS,CAAC,UAAU;gBACzB,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAyB,EACzB,IAA0B;IAE1B,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E,wDAAwD;IACxD,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAChE,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAC3C,CAAC;IAEF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CACX,uFAAuF,EACvF,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,CAChC,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAED,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC;IACrC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAE9B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,yBAAyB;SACjC,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAE5D,IAAI,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,UAAU,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;QAE/E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,4BAA4B,UAAU,GAAG;aACjD,CAAC;QACJ,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,sBAAsB,UAAU,SAAS;aACjD,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAE5E,IAAI,QAAQ,IAAI,CAAC,KAAK,IAAI,UAAU,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC/D,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,UAAU,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;YAE/E,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YACvB,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,sBAAsB,UAAU,SAAS;gBAChD,YAAY,EAAE,CAAC,UAAU,CAAC;aAC3B,CAAC;QACJ,CAAC;QAED,OAAO;YACL,IAAI,EAAE,IAAI;YACV,IAAI,EAAE;gBACJ,GAAG,EAAE,OAAO,CAAC,GAAa;gBAC1B,GAAG,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;oBACvC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;oBAClC,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;gBACzC,KAAK,EAAE,OAAO,CAAC,KAA6B;aAC7C;SACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC"}
+{"version":3,"file":"ensureCookies.js","sourceRoot":"","sources":["../src/ensureCookies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAsDrD,MAAM,mBAAmB,GAGrB;IACF,wBAAwB,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE;IACvE,uBAAuB,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE;IACtE,0BAA0B,EAAE;QAC1B,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,IAAI;KACf;IACD,2BAA2B,EAAE;QAC3B,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,IAAI;KACf;IACD,uBAAuB,EAAE;QACvB,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,IAAI;KACf;IACD,uBAAuB,EAAE;QACvB,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,IAAI;KACf;IACD,yBAAyB,EAAE;QACzB,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,IAAI;KACf;IACD,yBAAyB,EAAE;QACzB,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,IAAI;KACf;IACD,6BAA6B,EAAE;QAC7B,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,IAAI;KACf;IACD,6BAA6B,EAAE;QAC7B,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,IAAI;KACf;IACD,+BAA+B,EAAE;QAC/B,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,IAAI;KACf;IACD,+BAA+B,EAAE;QAC/B,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,IAAI;KACf;IACD,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,0BAA0B;IAC1B,oBAAoB,EAAE;QACpB,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,KAAK;KAChB;IACD,8EAA8E;IAC9E,6EAA6E;IAC7E,mBAAmB,EAAE;QACnB,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,IAAI;KACf;IACD,aAAa,EAAE;QACb,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,IAAI;KACf;IACD,aAAa,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC3D,SAAS,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IACvD,WAAW,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IACzD,eAAe,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC7D,oBAAoB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAClE,WAAW,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IACzD,gBAAgB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC9D,iBAAiB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC/D,yBAAyB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IACvE,0BAA0B,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IACxE,cAAc,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC5D,oBAAoB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAClE,qBAAqB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IACnE,eAAe,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC7D,kBAAkB,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAChE,6BAA6B,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC3E,+BAA+B,EAAE;QAC/B,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,IAAI;KACf;IACD,kCAAkC,EAAE;QAClC,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,IAAI;KACf;IAED,+BAA+B,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC7E,mCAAmC,EAAE;QACnC,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,IAAI;KACf;IAED,8BAA8B,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAE5E,aAAa,EAAE;QACb,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,IAAI;KACf;IACD,yBAAyB,EAAE;QACzB,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,IAAI;KACf;IACD,iBAAiB,EAAE;QACjB,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,IAAI;KACf;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,IAAI;KACf;IACD,sBAAsB,EAAE;QACtB,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,IAAI;KACf;IAED,sBAAsB,EAAE;QACtB,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,IAAI;KACf;IAED,6EAA6E;IAC7E,gCAAgC,EAAE;QAChC,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,IAAI;KACf;IAED,sBAAsB,EAAE;QACtB,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,IAAI;KACf;CACF,CAAC;AAEF,KAAK,UAAU,qBAAqB,CAClC,UAAkB,EAClB,aAAiC,EACjC,IAA0B;IAE1B,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE;QACxD,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,gBAAgB;YACvB,YAAY,EAAE;gBACZ,UAAU;gBACV,IAAI,CAAC,sBAAsB;gBAC3B,IAAI,CAAC,iBAAiB;aACvB;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,IAAI;QACV,IAAI,EAAE;YACJ,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,GAAG,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC;YACvC,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,KAAK,EAAE,SAAS,CAAC,KAAK;SACvB;QACD,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE;oBACL,GAAG,EAAE,SAAS,CAAC,GAAG;oBAClB,GAAG,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS;wBACnC,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC;oBACvC,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,cAAc,EAAE,SAAS,CAAC,cAAc,IAAI,IAAI;iBACjD;gBACD,GAAG,EAAE,SAAS,CAAC,GAAG;gBAClB,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;YACD;gBACE,IAAI,EAAE,IAAI,CAAC,iBAAiB;gBAC5B,KAAK,EAAE;oBACL,GAAG,EAAE,SAAS,CAAC,GAAG;oBAClB,YAAY,EAAE,SAAS,CAAC,YAAY;iBACrC;gBACD,GAAG,EAAE,SAAS,CAAC,UAAU;gBACzB,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAyB,EACzB,IAA0B;IAE1B,aAAa,CAAC,IAAI,CAAC,CAAC;IAEpB,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E,wDAAwD;IACxD,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAChE,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAC3C,CAAC;IAEF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAED,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC;IAErC,8EAA8E;IAC9E,8EAA8E;IAC9E,iCAAiC;IACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAE9B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,yBAAyB;SACjC,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAE5D,IAAI,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,UAAU,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;QAE/E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,4BAA4B,UAAU,GAAG;aACjD,CAAC;QACJ,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,sBAAsB,UAAU,SAAS;aACjD,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAE5E,IAAI,QAAQ,IAAI,CAAC,KAAK,IAAI,UAAU,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC/D,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,UAAU,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;YAE/E,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YACvB,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,sBAAsB,UAAU,SAAS;gBAChD,YAAY,EAAE,CAAC,UAAU,CAAC;aAC3B,CAAC;QACJ,CAAC;QAED,OAAO;YACL,IAAI,EAAE,IAAI;YACV,IAAI,EAAE;gBACJ,GAAG,EAAE,OAAO,CAAC,GAAa;gBAC1B,GAAG,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;oBACvC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;oBAClC,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;gBACzC,KAAK,EAAE,OAAO,CAAC,KAA6B;aAC7C;SACF,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC"}

package/dist/getSeamlessUser.d.ts

@@ -1,8 +1,23 @@
+/**
+ * The user object returned by the auth server's `GET /users/me`.
+ *
+ * `lastLogin` is an ISO 8601 timestamp, null until the user's first login.
+ * `activeOrganizationId` is null when the access token carries no org context.
+ */
+export interface SeamlessUser {
+    id: string;
+    email: string;
+    phone: string | null;
+    roles: string[];
+    lastLogin?: string | null;
+    activeOrganizationId?: string | null;
+}
 export interface GetSeamlessUserOptions {
     authServerUrl: string;
     cookieSecret: string;
-    authorization: string;
+    authorization?: string;
     cookieName?: string;
+    serviceAuthorization?: string;
     forwardedClientIp?: string;
 }
 /**
@@ -15,5 +30,5 @@ export interface GetSeamlessUserOptions {
  *
  * This is intended for server-side usage (SSR, API routes, edge functions).
  */
-export declare function getSeamlessUser<T = any>(cookies: Record<string, string | undefined>, opts: GetSeamlessUserOptions): Promise<T | null>;
+export declare function getSeamlessUser<T = SeamlessUser>(cookies: Record<string, string | undefined>, opts: GetSeamlessUserOptions): Promise<T | null>;
 //# sourceMappingURL=getSeamlessUser.d.ts.map

package/dist/getSeamlessUser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getSeamlessUser.d.ts","sourceRoot":"","sources":["../src/getSeamlessUser.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,CAAC,GAAG,GAAG,EAC3C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC3C,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAmBnB"}
+{"version":3,"file":"getSeamlessUser.d.ts","sourceRoot":"","sources":["../src/getSeamlessUser.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,CAAC,GAAG,YAAY,EACpD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC3C,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAsBnB"}

package/dist/getSeamlessUser.js

@@ -1,5 +1,6 @@
 import { verifyCookieJwt } from "./verifyCookieJwt.js";
 import { authFetch } from "./authFetch.js";
+import { assertSecretStrength } from "./validateSecrets.js";
 /**
  * Resolves the authenticated Seamless Auth user from an access cookie.
  *
@@ -11,6 +12,7 @@ import { authFetch } from "./authFetch.js";
  * This is intended for server-side usage (SSR, API routes, edge functions).
  */
 export async function getSeamlessUser(cookies, opts) {
+    assertSecretStrength("cookieSecret", opts.cookieSecret);
     const cookieName = opts.cookieName ?? "seamless-access";
     const token = cookies[cookieName];
     if (!token)
@@ -21,11 +23,12 @@ export async function getSeamlessUser(cookies, opts) {
     const response = await authFetch(`${opts.authServerUrl}/users/me`, {
         method: "GET",
         authorization: opts.authorization,
+        serviceAuthorization: opts.serviceAuthorization,
         forwardedClientIp: opts.forwardedClientIp,
     });
     if (!response.ok)
         return null;
     const data = await response.json();
-    return data.user ?? null;
+    return data?.user ?? null;
 }
 //# sourceMappingURL=getSeamlessUser.js.map

package/dist/getSeamlessUser.js.map

@@ -1 +1 @@
-{"version":3,"file":"getSeamlessUser.js","sourceRoot":"","sources":["../src/getSeamlessUser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAU3C;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA2C,EAC3C,IAA4B;IAE5B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAElC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,WAAW,EAAE;QACjE,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"getSeamlessUser.js","sourceRoot":"","sources":["../src/getSeamlessUser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AA0B5D;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA2C,EAC3C,IAA4B;IAE5B,oBAAoB,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAExD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAElC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,WAAW,EAAE;QACjE,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;AAC5B,CAAC"}

package/dist/handlers/admin.d.ts

@@ -1,6 +1,7 @@
 type BaseOpts = {
     authServerUrl: string;
     authorization?: string;
+    serviceAuthorization?: string;
     forwardedClientIp?: string;
 };
 type WithQuery = BaseOpts & {

package/dist/handlers/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/handlers/admin.ts"],"names":[],"mappings":"AAEA,KAAK,QAAQ,GAAG;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,KAAK,SAAS,GAAG,QAAQ,GAAG;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC7B,CAAC;AAEF,KAAK,QAAQ,GAAG,QAAQ,GAAG;IACzB,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ,CAAC;AAEF,KAAK,MAAM,GAAG;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AA4CF,eAAO,MAAM,eAAe,GAAI,MAAM,QAAQ,oBACR,CAAC;AAEvC,eAAO,MAAM,iBAAiB,GAAI,MAAM,QAAQ,oBACT,CAAC;AAExC,eAAO,MAAM,iBAAiB,GAAI,MAAM,QAAQ,oBACP,CAAC;AAE1C,eAAO,MAAM,iBAAiB,GAAI,QAAQ,MAAM,EAAE,MAAM,QAAQ,oBACd,CAAC;AAEnD,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,EAAE,MAAM,QAAQ,oBACnB,CAAC;AAEjD,eAAO,MAAM,uBAAuB,GAAI,QAAQ,MAAM,EAAE,MAAM,QAAQ,oBACZ,CAAC;AAE3D,eAAO,MAAM,oBAAoB,GAAI,MAAM,SAAS,oBACR,CAAC;AAE7C,eAAO,MAAM,yBAAyB,GAAI,MAAM,QAAQ,oBACP,CAAC;AAElD,eAAO,MAAM,sBAAsB,GAAI,MAAM,SAAS,oBACb,CAAC;AAE1C,eAAO,MAAM,uBAAuB,GAAI,QAAQ,MAAM,EAAE,MAAM,QAAQ,oBACnB,CAAC;AAEpD,eAAO,MAAM,wBAAwB,GAAI,IAAI,MAAM,EAAE,MAAM,QAAQ,oBACX,CAAC;AAEzD,eAAO,MAAM,4BAA4B,GAAI,QAAQ,MAAM,EAAE,MAAM,QAAQ,oBACV,CAAC;AAElE,eAAO,MAAM,sCAAsC,GACjD,QAAQ,MAAM,EACd,MAAM,QAAQ,oBAE6D,CAAC"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/handlers/admin.ts"],"names":[],"mappings":"AAEA,KAAK,QAAQ,GAAG;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,KAAK,SAAS,GAAG,QAAQ,GAAG;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC7B,CAAC;AAEF,KAAK,QAAQ,GAAG,QAAQ,GAAG;IACzB,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ,CAAC;AAEF,KAAK,MAAM,GAAG;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AA6CF,eAAO,MAAM,eAAe,GAAI,MAAM,QAAQ,oBACR,CAAC;AAEvC,eAAO,MAAM,iBAAiB,GAAI,MAAM,QAAQ,oBACT,CAAC;AAExC,eAAO,MAAM,iBAAiB,GAAI,MAAM,QAAQ,oBACP,CAAC;AAE1C,eAAO,MAAM,iBAAiB,GAAI,QAAQ,MAAM,EAAE,MAAM,QAAQ,oBACM,CAAC;AAEvE,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,EAAE,MAAM,QAAQ,oBACC,CAAC;AAErE,eAAO,MAAM,uBAAuB,GAAI,QAAQ,MAAM,EAAE,MAAM,QAAQ,oBACQ,CAAC;AAE/E,eAAO,MAAM,oBAAoB,GAAI,MAAM,SAAS,oBACR,CAAC;AAE7C,eAAO,MAAM,yBAAyB,GAAI,MAAM,QAAQ,oBACP,CAAC;AAElD,eAAO,MAAM,sBAAsB,GAAI,MAAM,SAAS,oBACb,CAAC;AAE1C,eAAO,MAAM,uBAAuB,GAAI,QAAQ,MAAM,EAAE,MAAM,QAAQ,oBACC,CAAC;AAExE,eAAO,MAAM,wBAAwB,GAAI,IAAI,MAAM,EAAE,MAAM,QAAQ,oBACS,CAAC;AAE7E,eAAO,MAAM,4BAA4B,GAAI,QAAQ,MAAM,EAAE,MAAM,QAAQ,oBAKxE,CAAC;AAEJ,eAAO,MAAM,sCAAsC,GACjD,QAAQ,MAAM,EACd,MAAM,QAAQ,oBAMb,CAAC"}

package/dist/handlers/admin.js

@@ -12,6 +12,7 @@ async function request(method, path, opts) {
         method,
         authorization: opts.authorization,
         body: opts.body,
+        serviceAuthorization: opts.serviceAuthorization,
         forwardedClientIp: opts.forwardedClientIp,
     });
     const data = await up.json();
@@ -29,14 +30,14 @@ async function request(method, path, opts) {
 export const getUsersHandler = (opts) => request("GET", "/admin/users", opts);
 export const createUserHandler = (opts) => request("POST", "/admin/users", opts);
 export const deleteUserHandler = (opts) => request("DELETE", "/admin/users", opts);
-export const updateUserHandler = (userId, opts) => request("PATCH", `/admin/users/${userId}`, opts);
-export const getUserDetailHandler = (userId, opts) => request("GET", `/admin/users/${userId}`, opts);
-export const getUserAnomaliesHandler = (userId, opts) => request("GET", `/admin/users/${userId}/anomalies`, opts);
+export const updateUserHandler = (userId, opts) => request("PATCH", `/admin/users/${encodeURIComponent(userId)}`, opts);
+export const getUserDetailHandler = (userId, opts) => request("GET", `/admin/users/${encodeURIComponent(userId)}`, opts);
+export const getUserAnomaliesHandler = (userId, opts) => request("GET", `/admin/users/${encodeURIComponent(userId)}/anomalies`, opts);
 export const getAuthEventsHandler = (opts) => request("GET", "/admin/auth-events", opts);
 export const getCredentialCountHandler = (opts) => request("GET", "/admin/credential-count", opts);
 export const listAllSessionsHandler = (opts) => request("GET", "/admin/sessions", opts);
-export const listUserSessionsHandler = (userId, opts) => request("GET", `/admin/sessions/${userId}`, opts);
-export const revokeUserSessionHandler = (id, opts) => request("DELETE", `/admin/sessions/by-id/${id}`, opts);
-export const revokeAllUserSessionsHandler = (userId, opts) => request("DELETE", `/admin/sessions/${userId}/revoke-all`, opts);
-export const recoverUserForDeviceReplacementHandler = (userId, opts) => request("POST", `/admin/users/${userId}/recovery/device-replacement`, opts);
+export const listUserSessionsHandler = (userId, opts) => request("GET", `/admin/sessions/${encodeURIComponent(userId)}`, opts);
+export const revokeUserSessionHandler = (id, opts) => request("DELETE", `/admin/sessions/by-id/${encodeURIComponent(id)}`, opts);
+export const revokeAllUserSessionsHandler = (userId, opts) => request("DELETE", `/admin/sessions/${encodeURIComponent(userId)}/revoke-all`, opts);
+export const recoverUserForDeviceReplacementHandler = (userId, opts) => request("POST", `/admin/users/${encodeURIComponent(userId)}/recovery/device-replacement`, opts);
 //# sourceMappingURL=admin.js.map

package/dist/handlers/admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/handlers/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAsB5C,SAAS,QAAQ,CAAC,IAAY,EAAE,KAA2B;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,EAAE,GAAG,IAAI,eAAe,CAC5B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CACnC,CAAC,QAAQ,EAAE,CAAC;IAEb,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,MAA2C,EAC3C,IAAY,EACZ,IAA0B;IAE1B,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,QAAQ,CAAC,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EACpD;QACE,MAAM;QACN,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,sBAAsB;SAC7C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAc,EAAE,EAAE,CAChD,OAAO,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;AAEvC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAc,EAAE,EAAE,CAClD,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;AAExC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAc,EAAE,EAAE,CAClD,OAAO,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;AAE1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,IAAc,EAAE,EAAE,CAClE,OAAO,CAAC,OAAO,EAAE,gBAAgB,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;AAEnD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAAE,IAAc,EAAE,EAAE,CACrE,OAAO,CAAC,KAAK,EAAE,gBAAgB,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;AAEjD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAAE,IAAc,EAAE,EAAE,CACxE,OAAO,CAAC,KAAK,EAAE,gBAAgB,MAAM,YAAY,EAAE,IAAI,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAe,EAAE,EAAE,CACtD,OAAO,CAAC,KAAK,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,IAAc,EAAE,EAAE,CAC1D,OAAO,CAAC,KAAK,EAAE,yBAAyB,EAAE,IAAI,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,IAAe,EAAE,EAAE,CACxD,OAAO,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;AAE1C,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAAE,IAAc,EAAE,EAAE,CACxE,OAAO,CAAC,KAAK,EAAE,mBAAmB,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;AAEpD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACrE,OAAO,CAAC,QAAQ,EAAE,yBAAyB,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;AAEzD,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,MAAc,EAAE,IAAc,EAAE,EAAE,CAC7E,OAAO,CAAC,QAAQ,EAAE,mBAAmB,MAAM,aAAa,EAAE,IAAI,CAAC,CAAC;AAElE,MAAM,CAAC,MAAM,sCAAsC,GAAG,CACpD,MAAc,EACd,IAAc,EACd,EAAE,CACF,OAAO,CAAC,MAAM,EAAE,gBAAgB,MAAM,8BAA8B,EAAE,IAAI,CAAC,CAAC"}
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/handlers/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAuB5C,SAAS,QAAQ,CAAC,IAAY,EAAE,KAA2B;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,EAAE,GAAG,IAAI,eAAe,CAC5B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CACnC,CAAC,QAAQ,EAAE,CAAC;IAEb,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,MAA2C,EAC3C,IAAY,EACZ,IAA0B;IAE1B,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,QAAQ,CAAC,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EACpD;QACE,MAAM;QACN,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,sBAAsB;SAC7C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAc,EAAE,EAAE,CAChD,OAAO,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;AAEvC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAc,EAAE,EAAE,CAClD,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;AAExC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAc,EAAE,EAAE,CAClD,OAAO,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;AAE1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,IAAc,EAAE,EAAE,CAClE,OAAO,CAAC,OAAO,EAAE,gBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAAE,IAAc,EAAE,EAAE,CACrE,OAAO,CAAC,KAAK,EAAE,gBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;AAErE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAAE,IAAc,EAAE,EAAE,CACxE,OAAO,CAAC,KAAK,EAAE,gBAAgB,kBAAkB,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;AAE/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAe,EAAE,EAAE,CACtD,OAAO,CAAC,KAAK,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,IAAc,EAAE,EAAE,CAC1D,OAAO,CAAC,KAAK,EAAE,yBAAyB,EAAE,IAAI,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,IAAe,EAAE,EAAE,CACxD,OAAO,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;AAE1C,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAAE,IAAc,EAAE,EAAE,CACxE,OAAO,CAAC,KAAK,EAAE,mBAAmB,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;AAExE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACrE,OAAO,CAAC,QAAQ,EAAE,yBAAyB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,MAAc,EAAE,IAAc,EAAE,EAAE,CAC7E,OAAO,CACL,QAAQ,EACR,mBAAmB,kBAAkB,CAAC,MAAM,CAAC,aAAa,EAC1D,IAAI,CACL,CAAC;AAEJ,MAAM,CAAC,MAAM,sCAAsC,GAAG,CACpD,MAAc,EACd,IAAc,EACd,EAAE,CACF,OAAO,CACL,MAAM,EACN,gBAAgB,kBAAkB,CAAC,MAAM,CAAC,8BAA8B,EACxE,IAAI,CACL,CAAC"}

package/dist/handlers/finishLogin.d.ts

@@ -2,10 +2,12 @@ import type { CookiePayload } from "../ensureCookies.js";
 export interface FinishLoginInput {
     body: unknown;
     authorization?: string;
+    serviceAuthorization?: string;
     forwardedClientIp?: string;
 }
 export interface FinishLoginOptions {
     authServerUrl: string;
+    audience: string;
     cookieDomain?: string;
     accessCookieName: string;
     refreshCookieName: string;

package/dist/handlers/finishLogin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"finishLogin.d.ts","sourceRoot":"","sources":["../../src/handlers/finishLogin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,gBAAgB,EACvB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,iBAAiB,CAAC,CAgE5B"}
+{"version":3,"file":"finishLogin.d.ts","sourceRoot":"","sources":["../../src/handlers/finishLogin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,gBAAgB,EACvB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,iBAAiB,CAAC,CAkE5B"}

package/dist/handlers/finishLogin.js

@@ -5,6 +5,7 @@ export async function finishLoginHandler(input, opts) {
         method: "POST",
         body: input.body,
         authorization: input.authorization,
+        serviceAuthorization: input.serviceAuthorization,
         forwardedClientIp: input.forwardedClientIp,
     });
     const data = await up.json();
@@ -14,7 +15,7 @@ export async function finishLoginHandler(input, opts) {
             error: data,
         };
     }
-    const verifiedAccessToken = await verifySignedAuthResponse(data.token, opts.authServerUrl);
+    const verifiedAccessToken = await verifySignedAuthResponse(data.token, opts.authServerUrl, opts.audience);
     if (!verifiedAccessToken) {
         throw new Error("Invalid signed response from Auth Server");
     }

package/dist/handlers/finishLogin.js.map

@@ -1 +1 @@
-{"version":3,"file":"finishLogin.js","sourceRoot":"","sources":["../../src/handlers/finishLogin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AA2B1E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAuB,EACvB,IAAwB;IAExB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,wBAAwB,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,wBAAwB,CACxD,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,aAAa,CACnB,CAAC;IAEF,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,mBAAmB,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,SAAS,GACb,OAAO,mBAAmB,CAAC,GAAG,KAAK,QAAQ;QACzC,CAAC,CAAC,mBAAmB,CAAC,GAAG;QACzB,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI;QACV,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,IAAI,CAAC,gBAAgB;gBAC3B,KAAK,EAAE;oBACL,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;oBACjD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;iBAC5C;gBACD,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;YACD;gBACE,IAAI,EAAE,IAAI,CAAC,iBAAiB;gBAC5B,KAAK,EAAE;oBACL,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,YAAY,EAAE,IAAI,CAAC,YAAY;iBAChC;gBACD,GAAG,EAAE,IAAI,CAAC,UAAU;gBACpB,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"finishLogin.js","sourceRoot":"","sources":["../../src/handlers/finishLogin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AA6B1E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAuB,EACvB,IAAwB;IAExB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,wBAAwB,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,wBAAwB,CACxD,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,QAAQ,CACd,CAAC;IAEF,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,mBAAmB,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,SAAS,GACb,OAAO,mBAAmB,CAAC,GAAG,KAAK,QAAQ;QACzC,CAAC,CAAC,mBAAmB,CAAC,GAAG;QACzB,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI;QACV,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,IAAI,CAAC,gBAAgB;gBAC3B,KAAK,EAAE;oBACL,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;oBACjD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;iBAC5C;gBACD,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;YACD;gBACE,IAAI,EAAE,IAAI,CAAC,iBAAiB;gBAC5B,KAAK,EAAE;oBACL,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,YAAY,EAAE,IAAI,CAAC,YAAY;iBAChC;gBACD,GAAG,EAAE,IAAI,CAAC,UAAU;gBACpB,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/handlers/finishRegister.d.ts

@@ -3,10 +3,12 @@ export interface FinishRegisterInput {
     authorization?: string;
     headers?: Record<string, string>;
     body: unknown;
+    serviceAuthorization?: string;
     forwardedClientIp?: string;
 }
 export interface FinishRegisterOptions {
     authServerUrl: string;
+    audience: string;
     cookieDomain?: string;
     accessCookieName: string;
     refreshCookieName: string;

package/dist/handlers/finishRegister.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"finishRegister.d.ts","sourceRoot":"","sources":["../../src/handlers/finishRegister.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,WAAW,mBAAmB;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CA6D/B"}
+{"version":3,"file":"finishRegister.d.ts","sourceRoot":"","sources":["../../src/handlers/finishRegister.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,WAAW,mBAAmB;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CA+D/B"}

package/dist/handlers/finishRegister.js

@@ -6,6 +6,7 @@ export async function finishRegisterHandler(input, opts) {
         authorization: input.authorization,
         headers: input.headers,
         body: input.body,
+        serviceAuthorization: input.serviceAuthorization,
         forwardedClientIp: input.forwardedClientIp,
     });
     const data = await up.json();
@@ -15,7 +16,7 @@ export async function finishRegisterHandler(input, opts) {
             error: data,
         };
     }
-    const verified = await verifySignedAuthResponse(data.token, opts.authServerUrl);
+    const verified = await verifySignedAuthResponse(data.token, opts.authServerUrl, opts.audience);
     if (!verified) {
         throw new Error("Invalid signed response from Auth Server");
     }

package/dist/handlers/finishRegister.js.map

@@ -1 +1 @@
-{"version":3,"file":"finishRegister.js","sourceRoot":"","sources":["../../src/handlers/finishRegister.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AA2B1E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA0B,EAC1B,IAA2B;IAE3B,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,2BAA2B,EAAE;QAC3E,MAAM,EAAE,MAAM;QACd,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC7C,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,aAAa,CACnB,CAAC;IAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,SAAS,GACb,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAE9D,OAAO;QACL,MAAM,EAAE,GAAG;QACX,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,IAAI,CAAC,gBAAgB;gBAC3B,KAAK,EAAE;oBACL,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;oBACjD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB;gBACD,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;YACD;gBACE,IAAI,EAAE,IAAI,CAAC,iBAAiB;gBAC5B,KAAK,EAAE;oBACL,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,YAAY,EAAE,IAAI,CAAC,YAAY;iBAChC;gBACD,GAAG,EAAE,IAAI,CAAC,UAAU;gBACpB,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"finishRegister.js","sourceRoot":"","sources":["../../src/handlers/finishRegister.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AA6B1E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA0B,EAC1B,IAA2B;IAE3B,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,2BAA2B,EAAE;QAC3E,MAAM,EAAE,MAAM;QACd,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC7C,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,QAAQ,CACd,CAAC;IAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,SAAS,GACb,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAE9D,OAAO;QACL,MAAM,EAAE,GAAG;QACX,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,IAAI,CAAC,gBAAgB;gBAC3B,KAAK,EAAE;oBACL,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;oBACjD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB;gBACD,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;YACD;gBACE,IAAI,EAAE,IAAI,CAAC,iBAAiB;gBAC5B,KAAK,EAAE;oBACL,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,YAAY,EAAE,IAAI,CAAC,YAAY;iBAChC;gBACD,GAAG,EAAE,IAAI,CAAC,UAAU;gBACpB,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/handlers/internalMetrics.d.ts

@@ -1,6 +1,7 @@
 type BaseOpts = {
     authServerUrl: string;
     authorization?: string;
+    serviceAuthorization?: string;
     forwardedClientIp?: string;
 };
 type WithQuery = BaseOpts & {
@@ -16,6 +17,6 @@ export declare const getAuthEventTimeseriesHandler: (opts: WithQuery) => Promise
 export declare const getLoginStatsHandler: (opts: BaseOpts) => Promise<Result>;
 export declare const getSecurityAnomaliesHandler: (opts: BaseOpts) => Promise<Result>;
 export declare const getDashboardMetricsHandler: (opts: BaseOpts) => Promise<Result>;
-export declare const getGroupedEventSummaryHandler: (opts: BaseOpts) => Promise<Result>;
+export declare const getGroupedEventSummaryHandler: (opts: WithQuery) => Promise<Result>;
 export {};
 //# sourceMappingURL=internalMetrics.d.ts.map

package/dist/handlers/internalMetrics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internalMetrics.d.ts","sourceRoot":"","sources":["../../src/handlers/internalMetrics.ts"],"names":[],"mappings":"AAEA,KAAK,QAAQ,GAAG;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,KAAK,SAAS,GAAG,QAAQ,GAAG;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;CAC/D,CAAC;AAEF,KAAK,MAAM,GAAG;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAsCF,eAAO,MAAM,0BAA0B,GAAI,MAAM,SAAS,oBACd,CAAC;AAE7C,eAAO,MAAM,6BAA6B,GAAI,MAAM,SAAS,oBACd,CAAC;AAEhD,eAAO,MAAM,oBAAoB,GAAI,MAAM,QAAQ,oBACH,CAAC;AAEjD,eAAO,MAAM,2BAA2B,GAAI,MAAM,QAAQ,oBACf,CAAC;AAE5C,eAAO,MAAM,0BAA0B,GAAI,MAAM,QAAQ,oBACf,CAAC;AAE3C,eAAO,MAAM,6BAA6B,GAAI,MAAM,QAAQ,oBAChB,CAAC"}
+{"version":3,"file":"internalMetrics.d.ts","sourceRoot":"","sources":["../../src/handlers/internalMetrics.ts"],"names":[],"mappings":"AAEA,KAAK,QAAQ,GAAG;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,KAAK,SAAS,GAAG,QAAQ,GAAG;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;CAC/D,CAAC;AAEF,KAAK,MAAM,GAAG;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAuCF,eAAO,MAAM,0BAA0B,GAAI,MAAM,SAAS,oBACd,CAAC;AAE7C,eAAO,MAAM,6BAA6B,GAAI,MAAM,SAAS,oBACd,CAAC;AAEhD,eAAO,MAAM,oBAAoB,GAAI,MAAM,QAAQ,oBACH,CAAC;AAEjD,eAAO,MAAM,2BAA2B,GAAI,MAAM,QAAQ,oBACf,CAAC;AAE5C,eAAO,MAAM,0BAA0B,GAAI,MAAM,QAAQ,oBACf,CAAC;AAE3C,eAAO,MAAM,6BAA6B,GAAI,MAAM,SAAS,oBACjB,CAAC"}

package/dist/handlers/internalMetrics.js

@@ -11,6 +11,7 @@ async function get(path, opts) {
     const up = await authFetch(buildUrl(`${opts.authServerUrl}${path}`, opts.query), {
         method: "GET",
         authorization: opts.authorization,
+        serviceAuthorization: opts.serviceAuthorization,
         forwardedClientIp: opts.forwardedClientIp,
     });
     const data = await up.json();

package/dist/handlers/internalMetrics.js.map

@@ -1 +1 @@
-{"version":3,"file":"internalMetrics.js","sourceRoot":"","sources":["../../src/handlers/internalMetrics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAkB5C,SAAS,QAAQ,CAAC,IAAY,EAAE,KAA0B;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,EAAE,GAAG,IAAI,eAAe,CAC5B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CACnC,CAAC,QAAQ,EAAE,CAAC;IAEb,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,IAAY,EAAE,IAAe;IAC9C,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,QAAQ,CAAC,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EACpD;QACE,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,yBAAyB;SAChD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,IAAe,EAAE,EAAE,CAC5D,GAAG,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,IAAe,EAAE,EAAE,CAC/D,GAAG,CAAC,kCAAkC,EAAE,IAAI,CAAC,CAAC;AAEhD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAc,EAAE,EAAE,CACrD,GAAG,CAAC,mCAAmC,EAAE,IAAI,CAAC,CAAC;AAEjD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,IAAc,EAAE,EAAE,CAC5D,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;AAE5C,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,IAAc,EAAE,EAAE,CAC3D,GAAG,CAAC,6BAA6B,EAAE,IAAI,CAAC,CAAC;AAE3C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,IAAc,EAAE,EAAE,CAC9D,GAAG,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAC"}
+{"version":3,"file":"internalMetrics.js","sourceRoot":"","sources":["../../src/handlers/internalMetrics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAmB5C,SAAS,QAAQ,CAAC,IAAY,EAAE,KAA0B;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,EAAE,GAAG,IAAI,eAAe,CAC5B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC;SAChD,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CACnC,CAAC,QAAQ,EAAE,CAAC;IAEb,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,IAAY,EAAE,IAAe;IAC9C,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,QAAQ,CAAC,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,EACpD;QACE,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,yBAAyB;SAChD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,IAAe,EAAE,EAAE,CAC5D,GAAG,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,IAAe,EAAE,EAAE,CAC/D,GAAG,CAAC,kCAAkC,EAAE,IAAI,CAAC,CAAC;AAEhD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAc,EAAE,EAAE,CACrD,GAAG,CAAC,mCAAmC,EAAE,IAAI,CAAC,CAAC;AAEjD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,IAAc,EAAE,EAAE,CAC5D,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;AAE5C,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,IAAc,EAAE,EAAE,CAC3D,GAAG,CAAC,6BAA6B,EAAE,IAAI,CAAC,CAAC;AAE3C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,IAAe,EAAE,EAAE,CAC/D,GAAG,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAC"}

package/dist/handlers/login.d.ts

@@ -4,8 +4,10 @@ export interface LoginInput {
 }
 export interface LoginOptions {
     authServerUrl: string;
+    audience: string;
     cookieDomain?: string;
     preAuthCookieName: string;
+    serviceAuthorization?: string;
     forwardedClientIp?: string;
 }
 export interface LoginResult {

package/dist/handlers/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/handlers/login.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IACF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,YAAY,CAChC,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,WAAW,CAAC,CAuDtB"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/handlers/login.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC;IACF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,YAAY,CAChC,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,WAAW,CAAC,CAyDtB"}

package/dist/handlers/login.js

@@ -4,6 +4,7 @@ export async function loginHandler(input, opts) {
     const up = await authFetch(`${opts.authServerUrl}/login`, {
         method: "POST",
         body: input.body,
+        serviceAuthorization: opts.serviceAuthorization,
         forwardedClientIp: opts.forwardedClientIp,
     });
     const data = await up.json();
@@ -13,7 +14,7 @@ export async function loginHandler(input, opts) {
             error: data,
         };
     }
-    const verified = await verifySignedAuthResponse(data.token, opts.authServerUrl);
+    const verified = await verifySignedAuthResponse(data.token, opts.authServerUrl, opts.audience);
     if (!verified) {
         throw new Error("Invalid signed response from Auth Server");
     }